The computer this problem is occurring on had NIS 2007 and the BSODs were happenning. It was upgraded to NIS 2009 (nrt was used to uninstall 2007) and it's still giving the same BSOD:
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Sat Aug 8 11:04:42.866 2009 (GMT-7)
System Uptime: 10 days 0:51:54.896
Loading Kernel Symbols
...............................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck E3, {f56726e8, 850599b8, 0, 2}
Unable to load image SYMEVENT.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
*** WARNING: Unable to verify timestamp for BHDrvx86.sys
*** ERROR: Module load completed but symbols could not be loaded for BHDrvx86.sys
Probably caused by : SYMEVENT.SYS ( SYMEVENT+13579 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
RESOURCE_NOT_OWNED (e3)
A thread tried to release a resource it did not own.
Arguments:
Arg1: f56726e8, Address of resource
Arg2: 850599b8, Address of thread
Arg3: 00000000, Address of owner table if there is one
Arg4: 00000002
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xE3
PROCESS_NAME: CarboniteServic
LAST_CONTROL_TRANSFER: from 8052c6c6 to 8053767a
STACK_TEXT:
f0627bac 8052c6c6 000000e3 f56726e8 850599b8 nt!KeBugCheckEx+0x1b
f0627be0 f5669579 f0627c2c f566374c 850599b8 nt!ExReleaseResourceLite+0x12b
WARNING: Stack unwind information not available. Following frames may be wrong.
f0627be8 f566374c 850599b8 860fee80 e1fe4508 SYMEVENT+0x13579
f0627c2c f53f6eef 00000018 e1fe4508 f0627ce4 SYMEVENT+0xd74c
f0627c4c f53f9c3f f0627c5c e1c7d480 f5410128 BHDrvx86+0x1aeef
f0627c9c f5665a5d 860fee80 f0627cec f0627ccc BHDrvx86+0x1dc3f
f0627cac f5667f5a f0627cec c0000001 e1a80150 SYMEVENT+0xfa5d
f0627ccc f566a2e5 f0627ce4 861bb7d8 f0627d64 SYMEVENT+0x11f5a
f0627d50 804dd99f 01d6eb60 00000002 01d6eb40 SYMEVENT+0x142e5
f0627d50 00000000 01d6eb60 00000002 01d6eb40 nt!KiFastCallEntry+0xfc
ffffffff 00000000 00000000 00000000 00000000 0x0
STACK_COMMAND: kb
FOLLOWUP_IP:
SYMEVENT+13579
f5669579 ?? ???
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: SYMEVENT+13579
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: SYMEVENT
IMAGE_NAME: SYMEVENT.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 49934f4c
FAILURE_BUCKET_ID: 0xE3_SYMEVENT+13579
BUCKET_ID: 0xE3_SYMEVENT+13579
Followup: MachineOwner
---------
0: kd> lmvm SYMEVENT
start end module name
f5656000 f567b000 SYMEVENT T (no symbols)
Loaded symbol image file: SYMEVENT.SYS
Image path: SYMEVENT.SYS
Image name: SYMEVENT.SYS
Timestamp: Wed Feb 11 14:21:00 2009 (49934F4C)
CheckSum: 0002DA46
ImageSize: 00025000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
-
Help?